add asset licensing notices

Adds ASSETS.md, NOTICE.md, per-directory READMEs, third-party license texts, a CI check that notices don't rot, and README forking-guideline updates. Carves commissioned artwork, the licensed icon system, and Bluesky marks out of the blanket MIT license. See LEGMS-208. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-05 17:37:42 +03:00
parent 5db6b4e2fd
commit 4cacec1942
14 changed files with 862 additions and 1 deletions
@@ -0,0 +1,67 @@
+name: Asset notices
+
+# Verifies that every path named in ASSETS.md and NOTICE.md still exists.
+#
+# Those files tell forkers which assets our MIT license does not cover, and carry the third-party
+# attribution notices we are required to pass along. If an asset moves and the notice is not
+# updated, the notice silently stops meaning anything. This job makes that visible in review
+# rather than a year later.
+#
+# The two paths lists below are duplicated on purpose — GitHub Actions does not support YAML
+# anchors. Keep them in sync.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'ASSETS.md'
+      - 'NOTICE.md'
+      - 'LICENSE'
+      - 'licenses/**'
+      - 'assets/**'
+      - 'bskyembed/assets/**'
+      - 'bskyogcard/src/assets/**'
+      - 'bskyweb/static/**'
+      - 'bskyweb/embedr-static/**'
+      - 'modules/BlueskyClip/Images.xcassets/**'
+      - 'scripts/check-asset-notices.mjs'
+      - '.github/workflows/asset-notices.yml'
+  pull_request:
+    paths:
+      - 'ASSETS.md'
+      - 'NOTICE.md'
+      - 'LICENSE'
+      - 'licenses/**'
+      - 'assets/**'
+      - 'bskyembed/assets/**'
+      - 'bskyogcard/src/assets/**'
+      - 'bskyweb/static/**'
+      - 'bskyweb/embedr-static/**'
+      - 'modules/BlueskyClip/Images.xcassets/**'
+      - 'scripts/check-asset-notices.mjs'
+      - '.github/workflows/asset-notices.yml'
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check asset licensing notices
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Check out Git repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: ⚙️ Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: package.json
+
+      - name: 📜 Verify asset notices
+        run: node scripts/check-asset-notices.mjs